#!/bin/bash

# ----------------------------------------------------------------------
# Filename:   75680-auditctl-always.sh
# Version:    1.0
# Date:       2013/12/12
# Author:     yuanhui.shi
# Email:      yuanhui.shi@cs2c.com.cn
# Summary:    03系统安全功能-02审计功能-01auditctl-10使用选项S记录系统调用事件，使用nerver、always设置规则的有效行为
# Notes:      添加规则时的各项设置
# Copyright:  China Standard Software Co., Ltd.
# History：     
#             Version 1.0, 2013/12/12
#             -   The first one
# ----------------------------------------------------------------------

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:~/bin
export PATH

source ../../../lib/Echo.sh
source ./lib/cmd.sh
source ../../../lib/XmlParse.sh
source ./lib/Partition_parted.sh

function CleanData ()
{
  auditctl -D &>/dev/null
  echo "" >/var/log/audit/audit.log
  umount /mnt
  DeletePartition
  if [ $VAR == 0 ];then
     stop_daemon auditd
  else
     restart_daemon auditd
   fi
  rm -rf /tmp/tmp
  EchoInfo "75680-auditctl-always.sh执行完毕"
}

trap "CleanData" EXIT

CreatePartition

command -v systemctl &&  /bin/systemctl status auditd >/tmp/tmp || service auditd status >/tmp/tmp


if [ -z "`cat /tmp/tmp |grep pid`" ];then
   VAR=0
   start_daemon auditd
else
   VAR=1
   restart_daemon auditd
fi

Partition_NUM=`parted -s /dev/sda print |tail -2 |cut -d " " -f2`
mkfs.ext3  /dev/sda${Partition_NUM}
EchoResult "格式化ext3文件系统分区成功"


auditctl -D &>/dev/null
EchoInfo "添加规则，状态是never"
auditctl -a exit,never -S mount &>/dev/null
EchoResult "规则添加成功"

EchoInfo "开始mount动作"
mount /dev/sda${Partition_NUM} /mnt/
tty_NUM=`tty |cut -d "/" -f4`
PID_NUM=`ps -ef |grep bash |grep pts/${tty_NUM} |head -1|cut -d " " -f7`

[ -z "`ausearch -pp ${PID_NUM}`" ]
EchoResult "因为添加的规则监视状态为never，所以不能看见记录"

auditctl -D &>/dev/null
umount /mnt
EchoInfo "添加规则，状态是always"
auditctl -a exit,always -S mount &>/dev/null
EchoResult "规则添加成功"

EchoInfo "开始mount动作"
mount /dev/sda${Partition_NUM} /mnt/

ausearch -pp ${PID_NUM}
[ -n "`ausearch -pp ${PID_NUM} |grep time`" ]
EchoResult "因为添加的规则监视状态为always，所以能看见记录"


